Prometheus

Prometheus is an open-source monitoring and alerting toolkit that collects and stores time-series metrics from configured targets. It runs on TCP port 9090 for its web UI and HTTP API. Nmap identifies it as http on this port.

Prometheus instances are valuable reconnaissance targets because they aggregate metrics from across the infrastructure. By default, Prometheus has no authentication, and its web UI and API are fully accessible to anyone who can reach the port. The /targets page lists every monitored endpoint with hostnames, ports, and health status, effectively mapping the internal network. Metrics themselves may contain sensitive operational data, internal hostnames, and resource utilization patterns. The /api/v1/targets and /api/v1/label/__name__/values endpoints provide structured access to this information.

Enumeration starts with the web UI to review active targets, alerting rules, and configured scrape jobs. The /config endpoint may expose the full Prometheus configuration, including scrape targets, authentication tokens for monitored services, and remote write destinations. Querying metrics with PromQL can reveal application-specific data, error rates, and capacity information. Checking for federation endpoints (/federate) that aggregate data from multiple Prometheus servers expands the reconnaissance scope further.